sakula | 37bfb1bb651a33e2d01536c458c5292efad6cdc3be5a9d5b48d9d2814f16a569

Analysis

max time kernel
142s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
23-06-2024 04:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

37bfb1bb651a33e2d01536c458c5292efad6cdc3be5a9d5b48d9d2814f16a569_NeikiAnalytics.exe
Size

108KB
MD5

e5a69f50a63733fa0c227bbf4688ede0
SHA1

8e05806721534921480587367c230cc329d6bd43
SHA256

37bfb1bb651a33e2d01536c458c5292efad6cdc3be5a9d5b48d9d2814f16a569
SHA512

58ea035e7fd288025b17e870e6500990256ae6dcb4ba53c8da33b9dae4406eaf177f1c07e1e712363bbd35745c7936520965ea4148d8d714955caebbb94a330a
SSDEEP

1536:oQFl29mEkE0L1rDEKrxZKF2zf9g2Pl7W/MwbxMX+8es52z30rtr0izbR9Xwz1:329DkEGRQixVSjLwes5G30BfPvwx

Score

10^/10

sakula persistence rat trojan

Malware Config

Extracted

Family

sakula

www.polarroute.com

Signatures

Sakula
Sakula is a remote access trojan with various capabilities.
trojan rat sakula

Sakula payload 4 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2028-0-0x0000000000400000-0x0000000000420000-memory.dmp	family_sakula
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe	family_sakula
behavioral1/memory/1820-7-0x0000000000400000-0x0000000000420000-memory.dmp	family_sakula
behavioral1/memory/2028-8-0x0000000000400000-0x0000000000420000-memory.dmp	family_sakula

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

2388 cmd.exe
Executes dropped EXE 1 IoCs

Processes:

MediaCenter.exe

pid process

1820 MediaCenter.exe
Loads dropped DLL 1 IoCs

Processes:

37bfb1bb651a33e2d01536c458c5292efad6cdc3be5a9d5b48d9d2814f16a569_NeikiAnalytics.exe

pid process

2028 37bfb1bb651a33e2d01536c458c5292efad6cdc3be5a9d5b48d9d2814f16a569_NeikiAnalytics.exe

pid	process
2388	cmd.exe

pid	process
1820	MediaCenter.exe

pid	process
2028	37bfb1bb651a33e2d01536c458c5292efad6cdc3be5a9d5b48d9d2814f16a569_NeikiAnalytics.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

37bfb1bb651a33e2d01536c458c5292efad6cdc3be5a9d5b48d9d2814f16a569_NeikiAnalytics.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe"	37bfb1bb651a33e2d01536c458c5292efad6cdc3be5a9d5b48d9d2814f16a569_NeikiAnalytics.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

1832 PING.EXE
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

37bfb1bb651a33e2d01536c458c5292efad6cdc3be5a9d5b48d9d2814f16a569_NeikiAnalytics.exe

description pid process

Token: SeIncBasePriorityPrivilege 2028 37bfb1bb651a33e2d01536c458c5292efad6cdc3be5a9d5b48d9d2814f16a569_NeikiAnalytics.exe

pid	process
1832	PING.EXE

description	pid	process
Token: SeIncBasePriorityPrivilege	2028	37bfb1bb651a33e2d01536c458c5292efad6cdc3be5a9d5b48d9d2814f16a569_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

37bfb1bb651a33e2d01536c458c5292efad6cdc3be5a9d5b48d9d2814f16a569_NeikiAnalytics.execmd.exe

description	pid	process	target process
PID 2028 wrote to memory of 1820	2028	37bfb1bb651a33e2d01536c458c5292efad6cdc3be5a9d5b48d9d2814f16a569_NeikiAnalytics.exe	MediaCenter.exe
PID 2028 wrote to memory of 1820	2028	37bfb1bb651a33e2d01536c458c5292efad6cdc3be5a9d5b48d9d2814f16a569_NeikiAnalytics.exe	MediaCenter.exe
PID 2028 wrote to memory of 1820	2028	37bfb1bb651a33e2d01536c458c5292efad6cdc3be5a9d5b48d9d2814f16a569_NeikiAnalytics.exe	MediaCenter.exe
PID 2028 wrote to memory of 1820	2028	37bfb1bb651a33e2d01536c458c5292efad6cdc3be5a9d5b48d9d2814f16a569_NeikiAnalytics.exe	MediaCenter.exe
PID 2028 wrote to memory of 2388	2028	37bfb1bb651a33e2d01536c458c5292efad6cdc3be5a9d5b48d9d2814f16a569_NeikiAnalytics.exe	cmd.exe
PID 2028 wrote to memory of 2388	2028	37bfb1bb651a33e2d01536c458c5292efad6cdc3be5a9d5b48d9d2814f16a569_NeikiAnalytics.exe	cmd.exe
PID 2028 wrote to memory of 2388	2028	37bfb1bb651a33e2d01536c458c5292efad6cdc3be5a9d5b48d9d2814f16a569_NeikiAnalytics.exe	cmd.exe
PID 2028 wrote to memory of 2388	2028	37bfb1bb651a33e2d01536c458c5292efad6cdc3be5a9d5b48d9d2814f16a569_NeikiAnalytics.exe	cmd.exe
PID 2388 wrote to memory of 1832	2388	cmd.exe	PING.EXE
PID 2388 wrote to memory of 1832	2388	cmd.exe	PING.EXE
PID 2388 wrote to memory of 1832	2388	cmd.exe	PING.EXE
PID 2388 wrote to memory of 1832	2388	cmd.exe	PING.EXE

C:\Users\Admin\AppData\Local\Temp\37bfb1bb651a33e2d01536c458c5292efad6cdc3be5a9d5b48d9d2814f16a569_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\37bfb1bb651a33e2d01536c458c5292efad6cdc3be5a9d5b48d9d2814f16a569_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2028

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
2⤵
- Executes dropped EXE
PID:1820

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\37bfb1bb651a33e2d01536c458c5292efad6cdc3be5a9d5b48d9d2814f16a569_NeikiAnalytics.exe"
2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:2388

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1
3⤵
- Runs ping.exe
PID:1832

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
Filesize
108KB

MD5
1dad9826ff06bf7ed6a01e5e843a4935

SHA1
185a7cce817b815ca1f27521d0923da825b23e74

SHA256
959a1c94fd60d1fb5b1796e338ae9f4d84edb15857662a5892ebfadf1e52a8c2

SHA512
9865b3c68ff3cbee93e8c6e666dc9dadf018dd0ab5f3f9677fa4196177a929fe6817eb1dbc67c49b066948765aa317ab3ac5ca10f90978ce5f0fd06490670003

Download Submit
memory/1820-7-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2028-0-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2028-6-0x0000000000230000-0x0000000000250000-memory.dmp

Filesize
128KB

Download
memory/2028-8-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2028-9-0x0000000000230000-0x0000000000250000-memory.dmp

Filesize
128KB

Download